A comprehensive approach to detecting RDP login failures

Light bulbs - several.

Syspeace’s way of detecting Windows logon failures is based on using the audit events produced by Windows. This is reliable and non-invasive, but in some cases, there are oddities. When a login succeeds or fails during Remote Desktop/Terminal Services authentication, the event is logged, but there is no reference to the IP address of the […]

Read more

top